Neural Network Host Platform for Generating Automated Suspicious Activity Reports Using Machine Learning

ABSTRACT

Aspects of the disclosure relate to using machine learning techniques for generating automated suspicious activity reports (SAR). A computing platform may generate a labelled transaction history dataset by combining historical transaction data with historical report information. The computing platform may train a convolutional neural network using the labelled transaction history dataset. The computing platform may receive new transaction data and compress the new transaction data using lossy compression. The computing platform may input the compressed transaction data into the convolutional neural network, which may cause the convolutional neural network to output a suspicious event probability score based on the compressed transaction data. The computing platform may determine whether the suspicious event probability score exceeds a predetermined threshold and, if so, the computing platform may send one or more commands directing a report processing system to generate a SAR, which may cause the report processing system to generate the SAR.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application claims the benefit of and priority to U.S. ProvisionalPatent Application Ser. No. 62/991,625, which was filed on Mar. 19,2020, and entitled “Neural Network Host Platform for GeneratingAutomated Suspicious Activity Reports Using Machine Learning,” and whichis incorporated by reference herein in its entirety.

BACKGROUND

Aspects of the disclosure relate to data processing systems, machinelearning, and event monitoring and reporting. In particular, one or moreaspects of the disclosure relate to computing platforms that implementmachine learning methods to monitor activity and automatically generatesuspicious activity reports.

In some cases, an enterprise organization may record data correspondingto a transaction history across a plurality of channels, each offered asan individual service. To avoid difficulties with analysis of manyvariables, features, or the like corresponding to this plurality ofchannels, this data may be approximated at an aggregate level foranalysis. This approximation may result in an error prone analysis ofthe transaction history data. As a result, it may be difficult forenterprise organizations to leverage historical transaction data as arobust information source for identification of suspicious activity.

SUMMARY

Aspects of the disclosure provide effective, efficient, scalable, andconvenient technical solutions that address and overcome the technicalproblems associated with monitoring activity and generating suspiciousactivity reports. For example, some aspects of the disclosure providetechniques that may enable computing devices to compress transactiondata using one or more lossy compression techniques for analysis by aconvolutional neural network to identify whether or not the transactiondata corresponds to a suspicious activity, and to direct a reportprocessing system to generate the report accordingly. In doing so,various technical advantages may be realized. For example, one technicaladvantage of applying lossy compression and machine learning totransaction data is that it allows the transaction data to be analyzedin its entirety, rather than using aggregate level approximations of thetransaction data. In doing so, error rates (e.g., false positive and/orfalse negative identifications) may be significantly reduced.Furthermore, by compressing the transaction data using vectorization,the transaction data may be enriched with data from other sources thatmay be formatted in a different manner. This may allow furtherinformation to be included in the suspicious activity analysis tofurther reduce errors rates. As yet an additional advantage, by reducingfalse positive identifications and/or automatically generating reports,investigator efficiency (e.g., with regard to transaction review andreport generation) may be increased and unnecessary cost (e.g., to fundreview of false positive cases) may be minimized or eliminated.

In accordance with one or more embodiments of the disclosure, acomputing platform comprising at least one processor, a communicationinterface, and memory storing computer-readable instructions maygenerate a labelled transaction history dataset by combining historicaltransaction data with historical report information. The computingplatform may train a convolutional neural network using the labelledtransaction history dataset. The computing platform may receive newtransaction data. The computing platform may compress the newtransaction data using at least one lossy compression method, which mayproduce compressed transaction data. The computing platform may inputthe compressed transaction data into the convolutional neural network,which may cause the convolutional neural network to output a suspiciousevent probability score based on the compressed transaction data. Thecomputing platform may determine whether the suspicious eventprobability score exceeds a first predetermined threshold. Based ondetermining that the suspicious event probability score exceeds thefirst predetermined threshold, the computing platform may send one ormore commands to a report processing system directing the reportprocessing system to generate a suspicious activity report (SAR), whichmay cause the report processing system to generate the SAR.

In one or more instances, the historical transaction data may be one ormore of: deposit amounts, frequency of deposits, identities ofdepositors, identities of individuals related to the depositors,location of deposits, account information, locations of institutionscorresponding to the account information, wire transfer frequencycorresponding to a plurality of historical transactions, or the like. Inone or more instances, the historical report information may indicatewhether or not a suspicious activity report (SAR) was generated based onthe historical transaction data.

In one or more instances, the new transaction data may be one or moreof: deposit amounts, frequency of deposits, identities of depositors,identities of individuals related to the depositors, location ofdeposits, account information, locations of institutions correspondingto the account information, wire transfer frequency corresponding to aplurality of new transactions, or the like, and the new transaction datamay be generated after the historical transaction data. In one or moreinstances, the computing platform may compress the new transaction datausing the at least one lossy compression method by feeding the newtransaction data into an auto encoder. In these instances, the autoencoder may: 1) generate one or more vector representations of the newtransaction data, 2) compute, using the one or more vectorrepresentations of the new transaction data, a mean value and a standarddeviation representative of the one or more vector representations ofthe new transaction data, 3) sample, in a random manner, the one or morevector representations of the new transaction data, 4) compute, usingthe sampled one or more vector representations of the new transactiondata, a mean value and a standard deviation representative of thesampled one or more vector representations of the new transaction data,5) determine whether a first difference between the mean value of thesampled one or more vector representations of the new transaction dataand the mean value of the one or more vector representations of the newtransaction data exceeds a first predetermined difference threshold andwhether a second difference between the standard deviation of thesampled one or more vector representations of the new transaction dataand the standard deviation of the one or more vector representations ofthe new transaction data exceeds a second predetermined differencethreshold, and 6) based on a determination that both: a) the firstdifference does not exceed the first predetermined difference threshold,and b) the second difference does not exceeds the second predetermineddifference threshold, output the compressed transaction data.

In one or more instances, the auto encoder may be further configured to:based on a determination that one or more of: a) the first differencedoes exceeds the first predetermined difference threshold, or b) thesecond difference exceeds the second predetermined differencethreshold: 1) integrate additional data from the one or more vectorrepresentations of the new transaction data into the sampled one or morevector representations of the new transaction data, 2) re-compute themean value and the standard deviation representative of the sampled oneor more vector representations of the new transaction data, and 3)determine whether the first difference between the mean value of thesampled one or more vector representations of the new transaction dataand the mean value of the one or more vector representations of the newtransaction data exceeds the first predetermined difference thresholdand whether the second difference between the standard deviation of thesampled one or more vector representations of the new transaction dataand the standard deviation of the one or more vector representations ofthe new transaction data exceeds a second predetermined differencethreshold. In one or more instances, the auto encoder may be avariational auto encoder.

In one or more instances, prior to inputting the compressed transactiondata into the convolutional neural network, the computing platform mayenrich the compressed transaction data by: 1) receiving customer profiledata corresponding to the new transaction data, 2) compressing thecustomer profile data using the at least one lossy compression method,and 3) combining the compressed customer profile data with thecompressed transaction data. In one or more instances, enriching thecompressed transaction data may result in a multi-dimensional vectorinput for the convolutional neural network.

In one or more instances, the customer profile data may be one or moreof: account information, contact information, social media information,law enforcement requests, or the like. In one or more instances, basedon determining that the suspicious event probability score does notexceed the first predetermined threshold, the computing platform maycompare the suspicious event probability score to a second predeterminedthreshold. Based on determining that the suspicious event probabilityscore exceeds the second predetermined threshold, the computing platformmay send one or more commands directing an enterprise user device todisplay a transaction review interface, which may cause the enterpriseuser device to display the transaction review interface. Based ondetermining that the suspicious event probability score does not exceedthe second predetermined threshold, the computing platform may determinethat the new transaction data does not correspond to a suspicious event.

In one or more instances, after determining whether or not the newtransaction data corresponds to a suspicious event, the computingplatform may update the convolutional neural network to includeadditional labelled data representative of the new transaction data andwhether or not a suspicious event was determined. In one or moreinstances, the suspicious event may be one or more of: money laundering,wire fraud, a large cash deposit, funneling, or the like.

These features, along with many others, are discussed in greater detailbelow.

BRIEF DESCRIPTION OF THE DRAWINGS

The present disclosure is illustrated by way of example and not limitedin the accompanying figures in which like reference numerals indicatesimilar elements and in which:

FIGS. 1A-1B depict an illustrative computing environment forimplementing machine learning techniques for generating automatedsuspicious activity reports in accordance with one or more exampleembodiments;

FIG. 2 depicts an illustrative method for implementing machine learningtechniques for generating automated suspicious activity reports inaccordance with one or more example embodiments;

FIGS. 3A-3G depict an illustrative event sequence for implementingmachine learning techniques for generating automated suspicious activityreports in accordance with one or more example embodiments;

FIG. 4 depicts an illustrative method for implementing machine learningtechniques for generating automated suspicious activity reports inaccordance with one or more example embodiments; and

FIG. 5 depicts an illustrative graphical user interface for implementingmachine learning techniques for generating automated suspicious activityreports in accordance with one or more example embodiments.

DETAILED DESCRIPTION

In the following description of various illustrative embodiments,reference is made to the accompanying drawings, which form a parthereof, and in which is shown, by way of illustration, variousembodiments in which aspects of the disclosure may be practiced. In someinstances, other embodiments may be utilized, and structural andfunctional modifications may be made, without departing from the scopeof the present disclosure.

It is noted that various connections between elements are discussed inthe following description. It is noted that these connections aregeneral and, unless specified otherwise, may be direct or indirect,wired or wireless, and that the specification is not intended to belimiting in this respect.

As a brief introduction to the concepts described further herein, one ormore of the systems and methods herein describe using data fromdifferent sources in various data formats to train a machine learningmodel. In some instances, this may be accomplished by compressing thedata (e.g., to roughly 1/10th of the size) and placing it in a commonformat that may be mixed and matched with other data sources todiscriminate between “crime” and “no crime.”

For example, one of the more robust sources of customer information(e.g., at an enterprise organization such as a financial institution) isthe history of transactions on a particular customer's account acrossmany channels (e.g., debit card, credit card, automated clearing house(ACH) transfers, wire transfers, or the like) offered as individualservices. One challenge with leveraging this information to identifyfinancial crime is that considering so many variables/featuressimultaneously over a long time horizon (e.g., years) may be impracticaldue to the amount of data involved. In some instances, aggregate leveldata for the various channels may be approximated, however, and this mayresult in an error prone analysis.

Such error prone analysis may result in cases being handed off toinvestigators that are false positives. Although investigators mayultimately identify the cases as false positive, this manual review maybe expensive and inefficient.

Transactional history may be one of the largest sources of informationreviewed by investigators deciding whether a particular financial crimehas been committed. For example, investigators may determine thatindividuals around the country are depositing large sums into aparticular account, and that a six figure wire transfer was subsequentlymade from the account to a watch list country. There may be asignificant amount of data involved in transaction historiescorresponding to a particular event, which may in some instances, spanover a year with twenty or more different parties. Encoding thesetransactions using a neural network and then training a different neuralnetwork on the history of similar cases may result in an effectivemethod for scoring potential criminal cases and identifying which casesshould be filed as suspicious to the federal government and/or result inadditional actions such as freezing or otherwise placing a hold on anaccount, or the like. In some instances, this approach may also allowfor the flexibility of layering additional sources of information, forexample, from a customer profile database, or the like.

Specifically, in some instances, compression of the different datasources (e.g., transactional history of a given party or customer) maybe accomplished using vectorization. This is described herein withregard to the use of an auto encoder (e.g., variational, or the like),although a variety of other algorithms may similarly be applied. In someinstances, features may be withheld from the variational auto encoder(e.g., to allow for independent adjustment, avoid signal degradation, orthe like), and still contributed to a convolutional neural network(CNN). Additionally, in some instances, customer profile information maybe vectorized in an unsupervised manner. It is important to note that,in some instances, the output vectors for the transaction history andthe customer profile information may have different dimensions, sizes,or the like. After these vectors are generated, they may be combined(e.g., regardless of their respective sizes to one another) using theCNN, as is illustrated in method 205 of FIG. 2. In some instances, theCNN may incorporate labelled data for previously reviewed crimes.

Accordingly, by performing one or more of the methods described above,one or more of the systems described herein may achieve significantlysmaller data sizes for the CNN. In some instances, this approach mayresult in data loss (e.g., lossy compression), but the benefits may besubstantial enough to outweigh this concern. For example, the losses fortransactional histories greater than twelve months may be on the orderof 1%, which may be reasonable considering the real-world computationalsavings of this data compression. For algorithms like CNNs, additionaldata may result in both processing time and memory consumption ofseveral orders of magnitude. Furthermore, one or more of the methodsdescribed herein may allow for incorporation of additional sources ofinformation in the analysis. By extracting mathematical vectorinformation from input data, data from various data sources may becombined in a robust manner.

FIGS. 1A-1B depict an illustrative computing environment that implementsmachine learning techniques for generating automated suspicious activityreports in accordance with one or more example embodiments. Referring toFIG. 1A, computing environment 100 may include one or more computersystems. For example, computing environment 100 may include atransaction data storage system 102, neural network host platform 103,enterprise user device 104, and report processing system 105.

Transaction data storage system 102 may be a server, server blade, orthe like configured to store data associated with an enterpriseorganization (e.g., transaction data for a financial institution, or thelike). For example, transaction data storage system 102 may beconfigured to store debit card data, credit card data, automatedclearing house (ACH) transfer data, wire transfer data, or the like. Insome instances, transaction storage system 102 may be configured tocommunicate with neural network host platform 103 to share historicaltransaction data.

As described further below, neural network host platform 103 may be acomputer system that includes one or more computing devices (e.g.,servers, server blades, or the like) and/or other computer components(e.g., processors, memories, communication interfaces) that may be usedto compress data (e.g., transaction data, customer profile data,reporting data, or the like) and/or implement machine learning models toidentify suspicious transactions and cause automated report generation.In some instances, the neural network host platform 103 may beconfigured to maintain a machine learning model that may includehistorical transaction data that is labelled based on whether or noteach data point was previously associated with a suspicious transaction.In some instances, neural network host platform 103 may be configured todynamically adjust or otherwise update the machine learning model basedon feedback and/or additional information.

Enterprise user device 104 may be a mobile device, tablet, smartphone,desktop computer, laptop computer, or the like, that may be used by anindividual to perform tasks for an enterprise organization. In someinstances, the enterprise user device 104 may be used by an employee ofan enterprise organization to perform one or more tasks related toidentification of suspicious activities, report generation, or the like.In some instances, the enterprise user device 104 may be configured todisplay transaction data (e.g., in response to one or more commands fromthe neural network host platform 103). For illustrative purposes,enterprise user device 104 is described throughout the following eventsequence with regard to performing suspicious activity identification.

Report processing system 105 may be a server, server blade, or the likeconfigured generate suspicious activity reports (SARs). For example, thereport processing system 105 may be configured to receive one or morecommands directing the report processing system 105 to generate the SARfrom the neural network host platform 103, the enterprise user device104, or the like. In some instances, the report processing system 105may be configured to send the SAR to one or more computing devicescorresponding to a law enforcement agency, financial institution, or thelike.

Computing environment 100 also may include one or more networks, whichmay interconnect transaction data storage system 102, neural networkhost platform 103, enterprise user device 104, report processing system105, or the like. For example, computing environment 100 may include anetwork 101 (which may interconnect, e.g., transaction data storagesystem 102, neural network host platform 103, enterprise user device104, report processing system 105, or the like).

In one or more arrangements, transaction data storage system 102, neuralnetwork host platform 103, enterprise user device 104, and/or reportprocessing system 105 may be any type of computing device capable ofsending and/or receiving requests and processing the requestsaccordingly. For example, transaction data storage system 102, neuralnetwork host platform 103, enterprise user device 104, report processingsystem 105 and/or the other systems included in computing environment100 may, in some instances, be and/or include server computers, desktopcomputers, laptop computers, tablet computers, smart phones, or the likethat may include one or more processors, memories, communicationinterfaces, storage devices, and/or other components. As noted above,and as illustrated in greater detail below, any and/or all oftransaction data storage system 102, neural network host platform 103,enterprise user device 104, and/or report processing system 105 may, insome instances, be special-purpose computing devices configured toperform specific functions.

Referring to FIG. 1B, neural network host platform 103 may include oneor more processors 111, memory 112, and communication interface 113. Adata bus may interconnect processor 111, memory 112, and communicationinterface 113. Communication interface 113 may be a network interfaceconfigured to support communication between neural network host platform103 and one or more networks (e.g., network 101, or the like). Memory112 may include one or more program modules having instructions thatwhen executed by processor 111 cause neural network host platform 103 toperform one or more functions described herein and/or one or moredatabases that may store and/or otherwise maintain information which maybe used by such program modules and/or processor 111. In some instances,the one or more program modules and/or databases may be stored by and/ormaintained in different memory units of neural network host platform 103and/or by different computing devices that may form and/or otherwisemake up neural network host platform 103. For example, memory 112 mayhave, host, store, and/or include neural network host module 112 a,neural network host database 112 b, and a machine learning engine 112 c.

Neural network host module 112 a may have instructions that directand/or cause neural network host platform 103 to execute advanced datacompression and machine learning techniques related to suspiciousactivity identification and automated report generation, as discussed ingreater detail below. Neural network host database 112 b may storeinformation used by neural network host module 112 a and/or neuralnetwork host platform 103 in application of machine learning techniquesrelated to suspicious activity identification and automated reportgeneration, and/or in performing other functions. Machine learningengine 112 c may have instructions that direct and/or cause the neuralnetwork host platform 103 to set, define, and/or iteratively refineoptimization rules and/or other parameters used by the neural networkhost platform 103 and/or other systems in computing environment 100.

FIGS. 3A-3G depict an illustrative event sequence that implementsmachine learning techniques for generating automated suspicious activityreports in accordance with one or more example embodiments. Referring toFIG. 3A, at step 301, transaction data storage system 102 may recordhistorical transaction data. For example, the transaction data storagesystem 102 may record historical debit card data, credit card data,automated clearing house (ACH) transfer data, wire transfer data,deposit amounts, frequency of deposits, identities of depositors,identities of individuals related to the depositors, location ofdeposits, account information, locations of institutions correspondingto the account information, or wire transfer frequency, or the likecorresponding to historical transactions. In some instances, thetransaction data storage system 102 may store the historical transactiondata for a predetermined period of time (e.g., 1 year, 5 years, 10years, or the like) and may then delete the historical transaction data.

At step 302, transaction data storage system 102 may establish aconnection with neural network host platform 103. For example, thetransaction data storage system 102 may establish a first wireless dataconnection with the neural network host platform 103 to link thetransaction data storage system 102 to the neural network host platform103 (e.g., in preparation for sending the historical transaction data).In some instances, the transaction data storage system 102 may determinewhether or not a connection is already established with the neuralnetwork host platform 103. If a connection is already established, thetransaction data storage system 102 might not re-establish theconnection. If a connection is not already established, the transactiondata storage system 102 may establish the first wireless data connectionas described herein.

At step 303, the transaction data storage system 102 may send thehistorical transaction data to the neural network host platform 103. Insome instances, the transaction data storage system 102 may send thehistorical transaction data to the neural network host platform 103 at apredetermined interval (e.g., once a day, once a week, or the like). Inother instances, the transaction data storage system 102 may sync withthe neural network host platform 103 to provide the historicaltransaction data to the neural network host platform 103 as it isrecorded. In some instances, the transaction data storage system 102 maysend the historical transaction data to the neural network host platform103 while the first wireless data connection is established.

At step 304, the neural network host platform 103 may receive thehistorical transaction data sent at step 303. In some instances, theneural network host platform 103 may receive the historical transactiondata via the communication interface 113 and while the first wirelessdata connection is established.

At step 305, the report processing system 105 may establish a connectionwith neural network host platform 103. For example, the reportprocessing system 105 may establish a second wireless data connectionwith the neural network host platform 103 to link the report processingsystem 105 to the neural network host platform (e.g., in preparation forsending historical report information). In some instances, the reportprocessing system 105 may identify whether a connection is alreadyestablished with the neural network host platform 103. If a connectionis already established with the neural network host platform 103, thereport processing system 105 might not re-establish the connection. If aconnection is not yet established with the neural network host platform103, the report processing system 105 may establish the second wirelessdata connection as described herein.

Referring to FIG. 3B, at step 306, the report processing system 105 maysend historical report information to the neural network host platform103. For example, the report processing system 105 may send informationincluded in historical suspicious activity reports that were generatedbased on the historical transaction data. In some instances, in sendingthe historical report information, the report processing system 105 maysend one or more of: a name, an address, a social security number, a taxidentifier, a birth date, a driver's license number, a passport number,an occupation of an involved party, a phone number, a date range, asuspicious activity code, a financial institution where the suspiciousactivity occurred, contact information for the financial institution,contact information for a law enforcement agency, a written descriptionof the suspicious activity, or the like. In one or more instances, thereport processing system 105 may send the historical report informationto the neural network host platform 103 while the second wireless dataconnection is established.

At step 307, the neural network host platform 103 may receive thehistorical report information sent at step 306. In some instances, theneural network host platform 103 may receive the historical reportinformation via the communication interface 113 and while the secondwireless data connection is established.

At step 308, the neural network host platform 103 may generate alabelled dataset by combining the historical transaction data receive atstep 304 and the historical report information received at step 307. Forexample, the neural network host platform 103 may identify correlationsbetween the historical report information and the historical transactiondata, and may store these correlations to generate a labelled datasetindicating whether or not a SAR was ultimately generated for each pieceof the historical transaction data.

At step 309, the neural network host platform 103 may feed the labelleddataset into a convolutional neural network (CNN) hosted by the neuralnetwork host platform 103. For example, the neural network host platform103 may feed the labelled dataset into the CNN for the purpose ofestablishing a machine learning dataset that may be used to analyzefuture transaction data using supervised learning. In some instances,the neural network host platform 103 may compress the labelled datasetprior to feeding it into the CNN (e.g., using an auto encoder and lossycompression as described below with regard to step 313 and furtherillustrated in FIG. 2). In other instances, the neural network hostplatform 103 might not compress the labelled dataset, but rather maystore the labelled dataset as originally generated.

At step 310, the transaction data storage system 102 may record newtransaction data. In some instances, in recording the new transactiondata, the transaction data storage system 102 may record similar data tothat described above at step 301 with regard to the historicaltransaction data. For example, the transaction data storage system 102may record one or more of: debit card data, credit card data, automatedclearing house (ACH) transfer data, wire transfer data, deposit amounts,frequency of deposits, identities of depositors, identities ofindividuals related to the depositors, location of deposits, accountinformation, locations of institutions corresponding to the accountinformation, or wire transfer frequency, or the like corresponding to atransactions corresponding to an event (e.g., a potential moneylaundering event, or the like). In these instances, the transaction datastorage system 102 may record transaction data corresponding to an eventthat occurred after recordation of the historical transaction data atstep 301.

Referring to FIG. 3C, at step 311, the transaction data storage system102 may send the new transaction data to the neural network hostplatform 103. In some instances, the transaction data storage system 102may send the new transaction data to the neural network host platform103 while the first wireless data connection is established.

At step 312, the neural network host platform 103 may receive the newtransaction data sent at step 311. In some instances, the neural networkhost platform 103 may receive the new transaction data via thecommunication interface 113 and while the first wireless data connectionis established.

At step 313, the neural network host platform 103 may compress the newtransaction data. For example, the neural network host platform 103 mayuse an auto encoder (e.g., a variational auto encoder, or the like) toapply one or more lossy compression techniques to the new transactiondata. In some instances, in compressing the new transaction data, theneural network host platform 103 may generate one or more numericvectors representative of the new transaction data. In these instances,the neural network host platform 103 may compute a mean and/or standarddeviation of the one or more numeric vectors representative of the newtransaction data. Subsequently, in these instances, the neural networkhost platform 103 may sample the one or more numeric vectorsrepresentative of the new transaction data by randomly selecting asubset of the data included in the one or more numeric vectorsrepresentative of the new transaction data. The neural network hostplatform 103 may then compute a mean and/or standard deviation of thesampled numeric vector, and may compare these values to the mean and/orstandard deviation of the one or more numeric vectors representative ofthe new transaction data. If the difference is greater than apredetermined threshold, the neural network host platform 103 maycontinue to add additional data from the one or more numeric vectorsrepresentative of the new transaction data until the difference is lessthan the predetermined threshold. If the difference is less than thepredetermined threshold, the neural network host platform 103 maycontinue to step 314. This compression is further illustrated in the“transactions unsupervised” portion of the method 205, which is shown inFIG. 2.

By compressing the transaction data in this way, the neural network hostplatform 103 may achieve significantly smaller data sizes. Although thismethod may result in some data loss, this may be on the order of merely1% for transactional histories going back greater than twelve months.Furthermore, such smaller data sizes may result in significantcomputations savings for the neural network host platform 103,specifically with regard to implementation of the CNN, which may havelimitations in both processing time and memory consumption of severalorders of magnitude, and furthermore may have difficulty processingcategorical data (e.g., binary decisions, or the like). Rather, toachieve the benefits of CNN analysis, the data should be specificallyformatted as an input (e.g., similar to red-green-blue (RGB) for images,or the like). On this note, it may be important to apply CNN analysisdue to the substantial amount of data involved (e.g., it may bedifficult to analyze the transaction data without applying deeplearning). Accordingly, by compressing the transaction data using lossycompression, the neural network host platform 103 may achieve thebenefits of CNN analysis, which might not otherwise be available due tothe substantial amount of data involved.

In some instances, certain portions of the new transaction data mightnot be compressed as described herein (e.g., to allow for independentadjustment, prevent degradation of signal, or the like). In theseinstances, these portions of the new transaction data might not becompressed, but may nevertheless be fed into the CNN as described belowat step 315.

At step 314, the neural network host platform 103 may enrich thecompressed transaction data. For example, the neural network hostplatform 103 may receive or otherwise have access to additional datasuch as customer profile data, social media data, law enforcementrecords, or the like. In these instances, the neural network hostplatform 103 may use the auto encoder (e.g., a variational auto encoder)to apply one or more lossy compression techniques to the additional data(e.g., as described above at step 313 with regard to compression of thenew transaction data). In some instances, the compressed additional datamay have a different size and/or dimensions (e.g., vector dimensions)than the compressed transaction data. After compressing the additionaldata, the neural network host platform 103 may enrich the compressedtransaction data by combining the vector results corresponding to thecompressed additional data and the compressed transaction data. Forexample, the compressed transaction data may be a vector

$\quad\begin{matrix}3 \\(2) \\2\end{matrix}$

and the compressed additional data may be a vector (9 9) (as is shown inelement 4 of the method 205, which is illustrated in FIG. 2. The neuralnetwork host platform 103 may combine these vectors by multiplying themtogether, resulting in enriched compressed transaction data (e.g.,

$\left. {{\begin{pmatrix}3 \\2 \\2\end{pmatrix} \times (99)} = \begin{pmatrix}27 & 27 \\27 & 27 \\18 & 18\end{pmatrix}} \right).$

In doing so, the neural network host platform 103 may combine data froma number of different sources regardless of their dimensions/sizes. Insome instances, the neural network host platform 103 might not enrichthe compressed transaction data.

In these instances, the neural network host platform 103 may skip step314. In some instances, certain portions of the additional data mightnot be compressed as described herein (e.g., to allow for independentadjustment, prevent degradation of signal, or the like). In theseinstances, these portions of the additional data might not becompressed, but may nevertheless be fed into the CNN as described belowat step 315.

At step 315, the neural network host platform 103 may feed the enrichedcompressed transaction data into the CNN. For example, the neuralnetwork host platform 103 may feed the enriched compressed transactiondata into the CNN for the purpose of using machine learning to identifywhether or not the enriched compressed transaction data corresponds to asuspicious activity and/or whether or not a SAR should be generatedaccordingly.

Referring to FIG. 3D, at step 316, the neural network host platform 103may compute a suspicious event probability score using the CNN. Forexample, the neural network host platform 103 may apply one or moremachine learning algorithms to compare the compressed transaction data(e.g., which may be the enriched compressed transaction data) to thelabelled dataset fed into the CNN at step 309. For example, the neuralnetwork host platform 103 may identify matches (e.g., exact matches,fuzzy matches, or the like) between the new transaction data and thehistorical transaction data. In doing so, the neural network hostplatform 103 may identify whether the matches correspond to historicaltransaction data labelled with historical report information. In theseinstances, the neural network host platform 103 may compute a higherscore as additional corresponding historical report information isidentified, and a lower score as less corresponding historical reportinformation is identified. In some instances, in computing thesuspicious event probability score, the neural network host platform 103may compute a numeric value between 0 and 100, with 0 being the leastlikely that a report should be generated and 100 being the most likely.Accordingly, as a result of being fed compressed transaction data, theCNN may output the suspicious event probability score.

Additionally or alternatively, in generating the suspicious eventprobability score, the neural network host platform 103 may compute anoutput vector that includes a probability that the new transaction datacorresponds to each of a plurality of money laundering crimes (e.g.,wire fraud, large cash deposits, funneling, or the like). In theseinstances, the neural network host platform 103 may subsequently compareeach of these probabilities to the various thresholds described below,and may determine that the given threshold is exceeded if at least oneof the probabilities exceeds the threshold (e.g., if the wire fraudprobability exceeds a threshold, but cash deposit/funnelingprobabilities do not, the neural network host platform 103 maynevertheless determine that the threshold is exceeded).

At step 317, the neural network host platform 103 may compare thesuspicious event probability score to a first predetermined threshold.For example, the neural network host platform 103 may set a firstpredetermined threshold of 75. If the neural network host platform 103determines that the suspicious event probability score exceeds the firstpredetermined threshold, the neural network host platform 103 mayproceed to step 318. If the neural network host platform 103 determinesthat the suspicious event probability score does not exceed the firstpredetermined threshold, the neural network host platform 103 mayproceed to step 323.

In some instances, the neural network host platform 103 may dynamicallyadjust the first predetermined threshold using machine learning. Forexample, the neural network host platform 103 may have a targetpercentage for a number of suspicious event probability scores thatshould exceed the first predetermined threshold (e.g., 15%, or thelike). In this example, if the neural network host platform 103determines that 25% of the suspicious event probability scores areexceeding the first predetermined threshold, the neural network hostplatform 103 may increase the first predetermined threshold. Incontrast, if 10% of suspicious event probability scores exceed the firstpredetermined threshold, the neural network host platform 103 maydecrease the first predetermined threshold.

At step 318, the neural network host platform 103 may generate one ormore commands directing the report processing system 105 to generate aSAR report. In some instances, the neural network host platform 103 maygenerate the one or more commands directing the report processing system105 to generate the SAR report based on or in response to thedetermination at step 317 that the suspicious event probability scoreexceeds the first predetermined threshold.

At step 319, the neural network host platform 103 may send the one ormore commands directing the report processing system 105 to generate aSAR report. In some instances, the neural network host platform 103 maysend the one or more commands directing the report processing system 105to generate the SAR report via the communication interface 113 and whilethe second wireless data connection is established.

At step 320, the report processing system 105 may receive the one ormore commands directing the report processing system 105 to generate theSAR report. In some instances, the report processing system 105 mayreceive the one or more commands directing the report processing system105 to generate the SAR report while the second wireless data connectionis established.

Referring to FIG. 3E, at step 321, the report processing system 105 maygenerate the SAR report corresponding to the new transaction data. Forexample, the report processing system 105 may generate a reportincluding one or more of: a name, an address, a social security number,a tax identifier, a birth date, a driver's license number, a passportnumber, an occupation of an involved party, a phone number, a daterange, a suspicious activity code, a financial institution where thesuspicious activity occurred, contact information for the financialinstitution, contact information for a law enforcement agency, a writtendescription of the suspicious activity, or the like relating to the newtransaction data. In some instances, the report processing system 105may send this report to a law enforcement agency, financial institution,or the like for further investigation. In some instances, the reportprocessing system 105 may generate the SAR based on or in response toreceiving the one or more commands directing the report processingsystem 105 to generate the SAR report. In some instances, the reportprocessing system 105 may automatically generate the SAR report withoutadditional manual input. After generation of the SAR report at step 321,the event sequence may proceed to step 333.

At step 322, the neural network host platform 103 may compare thesuspicious event probability score to a second predetermined threshold,lower than the first predetermined threshold. For example, the neuralnetwork host platform 103 may set a second predetermined threshold of50. If the neural network host platform 103 determines that thesuspicious event probability score exceeds the second predeterminedthreshold, but not the first predetermined threshold, the neural networkhost platform 103 may proceed to step 323. If the neural network hostplatform 103 determines that the suspicious event probability score doesnot exceed the second predetermined threshold, the neural network hostplatform 103 may proceed to step 333.

At step 323, the neural network host platform 103 may generate one ormore commands directing the enterprise user device 104 to display atransaction review interface (e.g., an interface that may allow anemployee of a financial institution to manually review the newtransaction data). In one or more instances, the neural network hostplatform 103 may generate the transaction review interface. In otherinstances, the neural network host platform 103 may generate transactionreview interface information that may be used by the enterprise userdevice 104 to generate the transaction review interface.

At step 324, the neural network host platform 103 may establish aconnection with the enterprise user device 104. In some instances, theneural network host platform 103 may establish a third wireless dataconnection with the enterprise user device 104 to link the neuralnetwork host platform 103 to the enterprise user device 104 (e.g., inpreparation for sending the one or more commands directing theenterprise user device 104 to display a transaction review interface).In some instances, the neural network host platform 103 may identifywhether a connection is already established with the enterprise userdevice 104. If a connection is already established with the enterpriseuser device 104, the neural network host platform 103 might notre-establish the connection. If a connection is not yet established withthe enterprise user device 104, the neural network host platform 103 mayestablish the third wireless data connection as described herein.

Referring to FIG. 3F, at step 325, the neural network host platform 103may send the one or more commands directing the enterprise user device104 to display a transaction review interface. In some instances, theneural network host platform 103 may send the one or more commandsdirecting the enterprise user device 104 to display the transactionreview interface via the communication interface 113 and while the thirdwireless data connection is established. In some instances, the neuralnetwork host platform 103 may also send the transaction review interfaceor transaction review interface information to the enterprise userdevice 104.

At step 326, the enterprise user device 104 may receive the one or morecommands directing the enterprise user device 104 to display thetransaction review interface. In one or more instances, the neuralnetwork host platform 103 may receive the one or more commands directingthe enterprise user device 104 to display the transaction reviewinterface while the third wireless data connection is established. Insome instances, the enterprise user device 104 may also receive thetransaction review interface or transaction review interface informationfrom the neural network host platform 103.

At step 327, the enterprise user device 104 may display the transactionreview interface. For example, the enterprise user device 104 maydisplay a graphical user interface similar to graphical user interface505, which is illustrated in FIG. 5. In some instances, the enterpriseuser device 104 may display the new transaction data, along with optionsto generate or not generate a SAR report. In some instances, theenterprise user device 104 may display a graphical user interfacereceived from the neural network host platform 103. In other instances,the enterprise user device 104 may generate the graphical user interfacebased on transaction review interface information received from theneural network host platform 103. In some instances, the enterprise userdevice 104 may display the transaction review interface based on or inresponse to the one or more commands directing the enterprise userdevice 104 to display the transaction review interface.

At step 328, the enterprise user device 104 may receive a reportgeneration input (e.g., from an employee of an enterprise organizationsuch as a financial institution). In some instances, the enterprise userdevice 104 may receive the report generation input via a display of theenterprise user device 104. If the enterprise user device 104 receives areport generation input indicating that a report should be generated,the enterprise user device 104 may proceed to step 329. If theenterprise user device 104 receives a report generation input indicatingthat a report should not be generated, the event sequence may proceed tostep 333.

At step 329, the enterprise user device 104 may establish a connectionwith the report processing system 105. For example, the enterprise userdevice 104 may establish a fourth wireless data connection with thereport processing system 105 to link the enterprise user device 104 tothe report processing system 105 (e.g., in preparation for sending areport generation request). In some instances, the enterprise userdevice 104 may identify whether a connection is already established withthe report processing system 105. If a connection is already establishedwith the report processing system 105, the enterprise user device 104might not re-establish the connection. If a connection is not alreadyestablished with the report processing system 105, the enterprise userdevice 104 may establish the fourth wireless data connection asdescribed herein.

Referring to FIG. 3G, at step 330, the enterprise user device 104 maysend a report generation request to the report processing system 105. Insome instances, the enterprise user device 104 may send the reportgeneration request to the report processing system 105 while the fourthwireless data connection is established.

At step 331, the report processing system 105 may receive the reportgeneration request sent at step 330. In some instances, the reportprocessing system 105 may receive the report generation request whilethe fourth wireless data connection is established.

At step 332, the report processing system 105 ay generate the SAR reportbased on the report generation request received at step 331. Ingenerating the SAR report, the report processing system 105 may performsimilar actions to those described above with regard to step 321.

At step 333, the neural network host platform 103 may update the CNNbased on whether or not a SAR report was generated based on the newtransaction data. For example, the neural network host platform 103 mayreceive report information from the report processing system 105 (e.g.,as described above at step 307), label the new transaction data (e.g.,as described above at step 308), and incorporate the labelled newtransaction data into the CNN to update the labelled dataset. In doingso, the neural network host platform 103 may continuously anddynamically improve in the identification of suspicious activities.

Although the event sequence described herein primarily refers todistinguishing “crime” and “no crime” acts based on transaction data,other insights may be made based on other types of data using similarmethods without departing from the scope of this disclosure.

FIG. 4 depicts an illustrative method for implementing machine learningtechniques for generating automated suspicious activity reports inaccordance with one or more example embodiments. Referring to FIG. 4, atstep 405, a computing platform having at least one processor, acommunication interface, and memory may receive historical transactiondata. At step 410, the computing platform may receive historical reportdata. At step 415, the computing platform may generate a labelleddataset using the historical transaction data and the historical reportdata. At step 420, the computing platform may train a convolutionalneural network (CNN) using the labelled dataset. At step 425, thecomputing platform may receive new transaction data. At step 430, thecomputing platform may compress the new transaction data. At step 435,the computing platform may enrich the compressed transaction data. Atstep 440, the computing platform may feed the enriched compressedtransaction data into the CNN. At step 445, the computing platform maycompute a suspicious event probability score. At step 450, the computingplatform may determine whether the suspicious event probability scoreexceeds a first predetermined threshold. If the suspicious eventprobability score exceeds the first predetermined threshold, thecomputing platform may proceed to step 455. At step 455, the computingplatform may send one or more report generation commands to a reportprocessing system.

Returning to step 450, if the suspicious event probability score doesnot exceed the first predetermined threshold, the computing platform mayproceed to step 460. At step 460, the computing platform may determinewhether the suspicious event probability score exceeds a secondpredetermined threshold. If the suspicious event probability score doesnot exceed the second predetermined threshold, the method may end. Ifthe suspicious event probability score does exceed the secondpredetermined threshold, the computing platform may proceed to step 465.At step 465, the computing platform may send one or more transactionreview display commands to an enterprise user device.

One or more aspects of the disclosure may be embodied in computer-usabledata or computer-executable instructions, such as in one or more programmodules, executed by one or more computers or other devices to performthe operations described herein. Generally, program modules includeroutines, programs, objects, components, data structures, and the likethat perform particular tasks or implement particular abstract datatypes when executed by one or more processors in a computer or otherdata processing device. The computer-executable instructions may bestored as computer-readable instructions on a computer-readable mediumsuch as a hard disk, optical disk, removable storage media, solid-statememory, RAM, and the like. The functionality of the program modules maybe combined or distributed as desired in various embodiments. Inaddition, the functionality may be embodied in whole or in part infirmware or hardware equivalents, such as integrated circuits,application-specific integrated circuits (ASICs), field programmablegate arrays (FPGA), and the like. Particular data structures may be usedto more effectively implement one or more aspects of the disclosure, andsuch data structures are contemplated to be within the scope of computerexecutable instructions and computer-usable data described herein.

Various aspects described herein may be embodied as a method, anapparatus, or as one or more computer-readable media storingcomputer-executable instructions. Accordingly, those aspects may takethe form of an entirely hardware embodiment, an entirely softwareembodiment, an entirely firmware embodiment, or an embodiment combiningsoftware, hardware, and firmware aspects in any combination. Inaddition, various signals representing data or events as describedherein may be transferred between a source and a destination in the formof light or electromagnetic waves traveling through signal-conductingmedia such as metal wires, optical fibers, or wireless transmissionmedia (e.g., air or space). In general, the one or morecomputer-readable media may be and/or include one or more non-transitorycomputer-readable media.

As described herein, the various methods and acts may be operativeacross one or more computing servers and one or more networks. Thefunctionality may be distributed in any manner, or may be located in asingle computing device (e.g., a server, a client computer, and thelike). For example, in alternative embodiments, one or more of thecomputing platforms discussed above may be combined into a singlecomputing platform, and the various functions of each computing platformmay be performed by the single computing platform. In such arrangements,any and/or all of the above-discussed communications between computingplatforms may correspond to data being accessed, moved, modified,updated, and/or otherwise used by the single computing platform.Additionally or alternatively, one or more of the computing platformsdiscussed above may be implemented in one or more virtual machines thatare provided by one or more physical computing devices. In sucharrangements, the various functions of each computing platform may beperformed by the one or more virtual machines, and any and/or all of theabove-discussed communications between computing platforms maycorrespond to data being accessed, moved, modified, updated, and/orotherwise used by the one or more virtual machines.

Aspects of the disclosure have been described in terms of illustrativeembodiments thereof. Numerous other embodiments, modifications, andvariations within the scope and spirit of the appended claims will occurto persons of ordinary skill in the art from a review of thisdisclosure. For example, one or more of the steps depicted in theillustrative figures may be performed in other than the recited order,and one or more depicted steps may be optional in accordance withaspects of the disclosure.

What is claimed is:
 1. A computing platform, comprising: at least oneprocessor; a communication interface communicatively coupled to the atleast one processor; and memory storing computer-readable instructionsthat, when executed by the at least one processor, cause the computingplatform to: generate a labelled transaction history dataset bycombining historical transaction data with historical reportinformation; train a convolutional neural network using the labelledtransaction history dataset; receive new transaction data; compress thenew transaction data using at least one lossy compression method,wherein compressing the new transaction data using the at least onelossy compression method produces compressed transaction data; input thecompressed transaction data into the convolutional neural network,wherein inputting the compressed transaction data into the convolutionalneural network causes the convolutional neural network to output asuspicious event probability score based on the compressed transactiondata; determine whether the suspicious event probability score exceeds afirst predetermined threshold; and based on determining that thesuspicious event probability score exceeds the first predeterminedthreshold, send one or more commands to a report processing systemdirecting the report processing system to generate a suspicious activityreport (SAR), wherein sending the one or more commands directing thereport processing system to generate the SAR causes the reportprocessing system to generate the SAR.
 2. The computing platform ofclaim 1, wherein the historical transaction data comprises one or moreof: deposit amounts, frequency of deposits, identities of depositors,identities of individuals related to the depositors, location ofdeposits, account information, locations of institutions correspondingto the account information, or wire transfer frequency corresponding toa plurality of historical transactions.
 3. The computing platform ofclaim 1, wherein the historical report information indicates whether ornot a suspicious activity report (SAR) was generated based on thehistorical transaction data.
 4. The computing platform of claim 1,wherein the new transaction data comprises one or more of: depositamounts, frequency of deposits, identities of depositors, identities ofindividuals related to the depositors, location of deposits, accountinformation, locations of institutions corresponding to the accountinformation, or wire transfer frequency corresponding to a plurality ofnew transactions, wherein the new transaction data is generated afterthe historical transaction data.
 5. The computing platform of claim 1,wherein compressing the new transaction data using the at least onelossy compression method comprises feeding the new transaction data intoan auto encoder, wherein the auto encoder: generates one or more vectorrepresentations of the new transaction data; computes, using the one ormore vector representations of the new transaction data, a mean valueand a standard deviation representative of the one or more vectorrepresentations of the new transaction data; samples, in a randommanner, the one or more vector representations of the new transactiondata; computes, using the sampled one or more vector representations ofthe new transaction data, a mean value and a standard deviationrepresentative of the sampled one or more vector representations of thenew transaction data; determines whether a first difference between themean value of the sampled one or more vector representations of the newtransaction data and the mean value of the one or more vectorrepresentations of the new transaction data exceeds a firstpredetermined difference threshold and whether a second differencebetween the standard deviation of the sampled one or more vectorrepresentations of the new transaction data and the standard deviationof the one or more vector representations of the new transaction dataexceeds a second predetermined difference threshold; and based on adetermination that both: 1) the first difference does not exceed thefirst predetermined difference threshold, and 2) the second differencedoes not exceeds the second predetermined difference threshold, outputsthe compressed transaction data.
 6. The computing platform of claim 5,wherein the auto encoder is further configured to: based on adetermination that one or more of: 1) the first difference does exceedsthe first predetermined difference threshold, or 2) the seconddifference exceeds the second predetermined difference threshold:integrate additional data from the one or more vector representations ofthe new transaction data into the sampled one or more vectorrepresentations of the new transaction data; re-compute the mean valueand the standard deviation representative of the sampled one or morevector representations of the new transaction data; and determinewhether the first difference between the mean value of the sampled oneor more vector representations of the new transaction data and the meanvalue of the one or more vector representations of the new transactiondata exceeds the first predetermined difference threshold and whetherthe second difference between the standard deviation of the sampled oneor more vector representations of the new transaction data and thestandard deviation of the one or more vector representations of the newtransaction data exceeds a second predetermined difference threshold. 7.The computing platform of claim 6, wherein the auto encoder comprises avariational auto encoder.
 8. The computing platform of claim 1, whereinthe memory stores additional computer-readable instructions that, whenexecuted by the at least one processor, further cause the computingplatform to: enrich, prior to inputting the compressed transaction datainto the convolutional neural network, the compressed transaction data,wherein enriching the compressed transaction data comprises: receivingcustomer profile data corresponding to the new transaction data;compressing the customer profile data using the at least one lossycompression method; and combining the compressed customer profile datawith the compressed transaction data.
 9. The computing platform of claim8, wherein enriching the compressed transaction data results in amulti-dimensional vector input for the convolutional neural network. 10.The computing platform of claim 8, wherein the customer profile datacomprises one or more of: account information, contact information,social media information, or law enforcement requests.
 11. The computingplatform of claim 1, wherein the memory stores additionalcomputer-readable instructions that, when executed by the at least oneprocessor, further cause the computing platform to: based on determiningthat the suspicious event probability score does not exceed the firstpredetermined threshold, compare the suspicious event probability scoreto a second predetermined threshold; based on determining that thesuspicious event probability score exceeds the second predeterminedthreshold, send one or more commands directing an enterprise user deviceto display a transaction review interface, wherein sending the one ormore commands directing the enterprise user device to display thetransaction review interface causes the enterprise user device todisplay the transaction review interface; and based on determining thatthe suspicious event probability score does not exceed the secondpredetermined threshold, determine that the new transaction data doesnot correspond to a suspicious event.
 12. The computing platform ofclaim 11, wherein the memory stores additional computer-readableinstructions that, when executed by the at least one processor, furthercause the computing platform to: update, after determining whether ornot the new transaction data corresponds to a suspicious event, theconvolutional neural network to include additional labelled datarepresentative of the new transaction data and whether or not asuspicious event was determined.
 13. The computing platform of claim 11,wherein the suspicious event comprises one or more of: money laundering,wire fraud, a large cash deposit, or funneling.
 14. A method comprising:at a computing platform comprising at least one processor, acommunication interface, and memory: generating a labelled transactionhistory dataset by combining historical transaction data with historicalreport information; training a convolutional neural network using thelabelled transaction history dataset; receiving new transaction data;compressing the new transaction data using at least one lossycompression method, wherein compressing the new transaction data usingthe at least one lossy compression method produces compressedtransaction data; inputting the compressed transaction data into theconvolutional neural network, wherein inputting the compressedtransaction data into the convolutional neural network causes theconvolutional neural network to output a suspicious event probabilityscore based on the compressed transaction data; determining whether thesuspicious event probability score exceeds a first predeterminedthreshold; and based on determining that the suspicious eventprobability score exceeds the first predetermined threshold, sending oneor more commands to a report processing system directing the reportprocessing system to generate a suspicious activity report (SAR),wherein sending the one or more commands directing the report processingsystem to generate the SAR causes the report processing system togenerate the SAR.
 15. The method of claim 14, wherein the historicaltransaction data comprises one or more of: deposit amounts, frequency ofdeposits, identities of depositors, identities of individuals related tothe depositors, location of deposits, account information, locations ofinstitutions corresponding to the account information, or wire transferfrequency corresponding to a plurality of historical transactions. 16.The method of claim 14, wherein the historical report informationindicates whether or not a suspicious activity report (SAR) wasgenerated based on the historical transaction data.
 17. The method ofclaim 14, wherein the new transaction data comprises one or more of:deposit amounts, frequency of deposits, identities of depositors,identities of individuals related to the depositors, location ofdeposits, account information, locations of institutions correspondingto the account information, or wire transfer frequency corresponding toa plurality of new transactions, wherein the new transaction data isgenerated after the historical transaction data.
 18. The method of claim14, wherein compressing the new transaction data using the at least onelossy compression method comprises feeding the new transaction data intoan auto encoder, wherein the auto encoder: generates one or more vectorrepresentations of the new transaction data; computes, using the one ormore vector representations of the new transaction data, a mean valueand a standard deviation representative of the one or more vectorrepresentations of the new transaction data; samples, in a randommanner, the one or more vector representations of the new transactiondata; computes, using the sampled one or more vector representations ofthe new transaction data, a mean value and a standard deviationrepresentative of the sampled one or more vector representations of thenew transaction data; determines whether a first difference between themean value of the sampled one or more vector representations of the newtransaction data and the mean value of the one or more vectorrepresentations of the new transaction data exceeds a firstpredetermined difference threshold and whether a second differencebetween the standard deviation of the sampled one or more vectorrepresentations of the new transaction data and the standard deviationof the one or more vector representations of the new transaction dataexceeds a second predetermined difference threshold; and based on adetermination that both: 1) the first difference does not exceed thefirst predetermined difference threshold, and 2) the second differencedoes not exceeds the second predetermined difference threshold, outputsthe compressed transaction data.
 19. The method of claim 18, wherein theauto encoder is further configured to: based on a determination that oneor more of: 1) the first difference does exceeds the first predetermineddifference threshold, or 2) the second difference exceeds the secondpredetermined difference threshold: integrate additional data from theone or more vector representations of the new transaction data into thesampled one or more vector representations of the new transaction data;re-compute the mean value and the standard deviation representative ofthe sampled one or more vector representations of the new transactiondata; and determine whether the first difference between the mean valueof the sampled one or more vector representations of the new transactiondata and the mean value of the one or more vector representations of thenew transaction data exceeds the first predetermined differencethreshold and whether the second difference between the standarddeviation of the sampled one or more vector representations of the newtransaction data and the standard deviation of the one or more vectorrepresentations of the new transaction data exceeds a secondpredetermined difference threshold.
 20. One or more non-transitorycomputer-readable media storing instructions that, when executed by acomputing platform comprising at least one processor, a communicationinterface, and memory, cause the computing platform to: generate alabelled transaction history dataset by combining historical transactiondata with historical report information; train a convolutional neuralnetwork using the labelled transaction history dataset; receive newtransaction data; compress the new transaction data using at least onelossy compression method, wherein compressing the new transaction datausing the at least one lossy compression method produces compressedtransaction data; input the compressed transaction data into theconvolutional neural network, wherein inputting the compressedtransaction data into the convolutional neural network causes theconvolutional neural network to output a suspicious event probabilityscore based on the compressed transaction data; determine whether thesuspicious event probability score exceeds a first predeterminedthreshold; and based on determining that the suspicious eventprobability score exceeds the first predetermined threshold, send one ormore commands to a report processing system directing the reportprocessing system to generate a suspicious activity report (SAR),wherein sending the one or more commands directing the report processingsystem to generate the SAR causes the report processing system togenerate the SAR.